virtiofs: add FUSE protocol validation

Add virtio_fs_verify_response() to validate that the server properly
follows the FUSE protocol by checking:

- Response length is at least sizeof(struct fuse_out_header).
- oh.len matches the actual response length.
- oh.unique matches the request's unique identifier.

On validation failure, set error to -EIO and normalize oh.len to prevent
underflow in copy_args_from_argbuf().

Addresses the TODO comment in virtio_fs_request_complete().

Signed-off-by: Yuto Ohnuki <ytohnuki@amazon.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index 057e65b51b99d70911335365981331d65a990891..2f7485ffac527444fa0668f2134d02b1cc56de53 100644 (file)
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -758,6 +758,27 @@ static void copy_args_from_argbuf(struct fuse_args *args, struct fuse_req *req)
        req->argbuf = NULL;
 }
 
+/* Verify that the server properly follows the FUSE protocol */
+static bool virtio_fs_verify_response(struct fuse_req *req, unsigned int len)
+{
+       struct fuse_out_header *oh = &req->out.h;
+
+       if (len < sizeof(*oh)) {
+               pr_warn("virtio-fs: response too short (%u)\n", len);
+               return false;
+       }
+       if (oh->len != len) {
+               pr_warn("virtio-fs: oh.len mismatch (%u != %u)\n", oh->len, len);
+               return false;
+       }
+       if (oh->unique != req->in.h.unique) {
+               pr_warn("virtio-fs: oh.unique mismatch (%llu != %llu)\n",
+                       oh->unique, req->in.h.unique);
+               return false;
+       }
+       return true;
+}
+
 /* Work function for request completion */
 static void virtio_fs_request_complete(struct fuse_req *req,
                                       struct virtio_fs_vq *fsvq)
@@ -767,10 +788,6 @@ static void virtio_fs_request_complete(struct fuse_req *req,
        unsigned int len, i, thislen;
        struct folio *folio;
 
-       /*
-        * TODO verify that server properly follows FUSE protocol
-        * (oh.uniq, oh.len)
-        */
        args = req->args;
        copy_args_from_argbuf(args, req);
 
@@ -824,6 +841,10 @@ static void virtio_fs_requests_done_work(struct work_struct *work)
                virtqueue_disable_cb(vq);
 
                while ((req = virtqueue_get_buf(vq, &len)) != NULL) {
+                       if (!virtio_fs_verify_response(req, len)) {
+                               req->out.h.error = -EIO;
+                               req->out.h.len = sizeof(struct fuse_out_header);
+                       }
                        spin_lock(&fpq->lock);
                        list_move_tail(&req->list, &reqs);
                        spin_unlock(&fpq->lock);